feat: Introduce `pypi.ca_certs` config entry (#1267)

* doc: Fix formatting of `python.use_venv`

* feat: Introduce `pypi.ca_certs` config entry

.pre-commit-config.yaml

@@ -31,3 +31,4 @@ repos:
         pass_filenames: false
         additional_dependencies:
           - types-requests
+          - types-certifi

docs/docs/usage/configuration.md

@@ -17,8 +17,9 @@ The following configuration items can be retrieved and modified by [`pdm config`
 | `project_max_depth`               | The max depth to search for a project through the parents                 | 5                                                                         | No                   | `PDM_PROJECT_MAX_DEPTH`  |
 | `python.path`                     | The Python interpreter path                                               |                                                                           | Yes                  | `PDM_PYTHON`             |
 | `python.use_pyenv`                | Use the pyenv interpreter                                                 | `True`                                                                    | Yes                  |                          |
-| `python.use_venv`                 | Install packages into the activated venv site packages instead of PEP 582 | `True`                                                                   | Yes                  | `PDM_USE_VENV`           |
+| `python.use_venv`                 | Install packages into the activated venv site packages instead of PEP 582 | `True`                                                                    | Yes                  | `PDM_USE_VENV`           |
 | `pypi.url`                        | The URL of PyPI mirror                                                    | `https://pypi.org/simple`                                                 | Yes                  | `PDM_PYPI_URL`           |
+| `pypi.ca_certs`                   | Path to a PEM-encoded CA cert bundle (used for server cert verification)  | The CA certificates from [certifi](https://pypi.org/project/certifi/)     | Yes                  |                          |
 | `pypi.verify_ssl`                 | Verify SSL certificate when query PyPI                                    | `True`                                                                    | Yes                  |                          |
 | `pypi.json_api`                   | Consult PyPI's JSON API for package metadata                              | `False`                                                                   | Yes                  | `PDM_PYPI_JSON_API`      |
 | `strategy.save`                   | Specify how to save versions when a package is added                      | `compatible`(can be: `exact`, `wildcard`, `minimum`)                      | Yes                  |                          |

news/1240.feature.md

+Allow the use of custom CA certificates using the `pypi.ca_certs` config entry.

pdm/models/environment.py

@@ -11,6 +11,7 @@ from contextlib import contextmanager
 from pathlib import Path
 from typing import TYPE_CHECKING, Generator
 
+import certifi
 import unearth
 
 from pdm import termui
@@ -138,6 +139,9 @@ class Environment:
             cache_dir=self.project.cache("http"),
             index_urls=index_urls,
             trusted_hosts=trusted_hosts,
+            ca_certificates=Path(
+                self.project.config.get("pypi.ca_certs", certifi.where())
+            ),
         )
         session.auth = self.auth
         finder = unearth.PackageFinder(

pdm/project/config.py

@@ -199,6 +199,10 @@ class Config(MutableMapping[str, str]):
         "pypi.verify_ssl": ConfigItem(
             "Verify SSL certificate when query PyPI", True, coerce=ensure_boolean
         ),
+        "pypi.ca_certs": ConfigItem(
+            "Path to a CA certificate bundle used for verifying the identity "
+            "of the PyPI server",
+        ),
         "pypi.json_api": ConfigItem(
             "Consult PyPI's JSON API for package metadata",
             False,

pyproject.toml

@@ -15,7 +15,7 @@ dependencies = [
     "virtualenv>=20",
     "pep517>=0.11.0",
     "requests-toolbelt",
-    "unearth>=0.5.2,<1",
+    "unearth>=0.6.0",
     "findpython>=0.2.0",
     "tomlkit>=0.8.0,<1",
     "shellingham>=1.3.2",
@@ -27,6 +27,7 @@ dependencies = [
     "tomli>=1.1.0; python_version < \"3.11\"",
     "typing-extensions; python_version < \"3.8\"",
     "importlib-metadata; python_version < \"3.8\"",
+    "certifi>=2022.6.15",
 ]
 name = "pdm"
 description = "A modern Python package and dependency manager supporting the latest PEP standards"
@@ -194,4 +195,3 @@ addopts = "-ra"
 testpaths = [
     "tests/",
 ]
-